8 ms·

Nearly all 2020 presidential candidates aren’t using a basic email security

67 points by sahin-boydas 8y ago

deleted 8y ago
[deleted]
lawlessone 8y ago
To be fair i don't think the incumbent needs to be worried about that.
idlewords 8y ago
Say what you will about Hillary Clinton—at least that woman could run an email server.
- lohszvu 8y ago
  Do you really think she was the one running it?
- october_sky 8y ago
  > Say what you will about Hillary Clinton—at least that woman could run an email server. Except she didn't. She hired an IT person to run a personal email server.
AdmiralAsshat 8y ago
I'd put this in a different category than 2FA, password manager, or basic "watch out or phishing emails" training. All of those things can be enacted by the individual end-user if the organization doesn't enforce it. But it doesn't look like DMARC is something the individual can turn on or off--it's completely on their IT to set it up. I'm not sure how easy it is to setup, either. Assuming they're paying for Office 365 or G-Suite for outlook/gmail on campaign domains, is that something that Microsoft and/or Google will turn on automatically for you?
- heavymark 8y ago
  With domains registered at Google Domains it's very easy to enable. All domain registers do not support it. Mayor Pete uses GoDaddy and very easy to setup at that register as well.
- jrockway 8y ago
  To setup DMARC, you add a text record like _dmarc.example.com with content like "v=DMARC1; p=reject" (or perhaps a more permissive or canaried policy). I am not sure if Google sets it up automatically. I have no memory of setting it up for my gsuite domain... but the record is there. I probably added it at some point though. The advantage of DMARC against phishing is that people without access to your email server can't impersonate people in your organization. If you tried sending me an email with a "From: jon@jrock.us" header, it would be rejected by my server and I would never see it. This makes it much more difficult to spearphish someone. If you could send an email "this is your boss, look at the From: field, now click my link!", a lot of people would click that link. If the From: field is "spammer@phishing.invalid", you might think twice. Every little bit helps.
  - erichurkman 8y ago
    If you have the domain through Google Domains and set up email through GSuite, they can set up DMARC automatically.
  - sokoloff 8y ago
    Wouldn't someone still be able to send mail from jon@jrơck.us and even have it pass DMARC and DKIM checks if they bought that domain? (last o being a ơ [ơ]) I wrote that fake address, I know where the defect is, and I can't spot the difference on my screen right now. It just looks like the other 50 specks of dirt on my laptop screen.
    - egwynn 8y ago
      One common way to defend against a partial (or full) homograph attack is to have clients render IDNs as punycode. The downside is that it kinda pulls the plug on non-ascii domains. :-\
astazangasta 8y ago
I am sure i will get hundreds of downvotes for this but i still dont accept that the Russians targeted the DNC. Wikileaks says otherwise, the only people who examined the servers are a nakedly anti-Russian security outfit hired by the DNC and to date zero hard evidence has been presented this is true. There are so many holes in this narrative, and given the total lack of credibility the press has after the Russiagate collusion story we shouldnt also allow this piece to slip through as accepted fact.
- codezero 8y ago
  I’m not sure the consensus is that WikiLeaks targeted the DNC (it’s not a hacking organization afaik). I believe that Russia targeted literally everyone and released DNC data through WikiLeaks. Edit: I think OP edited their message.
- belltaco 8y ago
  There's some substantial evidence. https://nos.nl/nieuwsuur/artikel/2213767-dutch-intelligence-first-to-alert-u-s-about-russian-hack-of-democratic-party.html https://nos.nl/nieuwsuur/artikel/2213767-dutch-intelligence-... https://arstechnica.com/tech-policy/2018/03/dnc-lone-hacker-guccifer-2-0-pegged-as-russian-spy-after-opsec-fail/ https://arstechnica.com/tech-policy/2018/03/dnc-lone-hacker-...
  - astazangasta 8y ago
    I've read both those accounts. The Dutch intelligence bit is unrelated to the DNC; they claim the same outfit they were surveilling is involved. They did not observe the Russians hacking the DNC. Read the story carefully to see the timing. As for Guccifer, the evidence indicates he operates out of CST (based on tweets and uploaded file timestamps), hardly where a Russian hacker would be situated. These are both pretty weak as evidence, not what i'd call substantial.
    - belltaco 8y ago
      And yet Wikileaks denial of them getting the emails from Russia without any proof whatsoever is somehow not weak? How would Wikileaks even verify that they were not dealing with a stooge of Russian intelligence?
andjd 8y ago
> just one presidential hopeful — Democratic candidate Elizabeth Warren — uses domain-based message authentication, reporting, and conformance policy — or DMARC. Another reason that Warren is my favorite of the democratic candidate right now. It's telling that the candidate with the most tech savvy is also the one proposing to break up the FAANGs for antitrust abuses.
- simonh 8y ago
  I'm not at all clear what a break up means. How do you break up a monolithic single platform like Facebook? Maybe spin off the messaging stuff but who cares about that? Google is tricky too, you could separate ad-driven search from everything else, but then the everything else bits would just die. How would that benefit users? Basically picking off bits of the edges of these services is just pointless, but splitting up the core service also seems crazy. It's like splitting up a car company by separating out the bit that makes the engines from the bit that makes the chassis. I can see it with Amazon splitting AWS from the store, but in that case both would just do fine thank you very much. Again, I'm not seeing any material benefits to anybody. I suppose it's possible profits from the store would be prevented from subsidising AWS, which might benefit competition. This is the only one that makes a lick of sense but it's not really a big problem to fix IMHO. So what are the actual proposals, or are they just vague pontificating at this stage?
  - torstenvl 8y ago
    How is the amalgamation of Instagram, WhatsApp, Facebook.com, Facebook Messenger, Oculus, etc. a "monolithic single platform"? I don't quite understand how you've come to your "who cares about that?"/"How would that benefit users?" stance. If you're genuinely curious about how preventing monopolies can benefit consumers/users, and not just being rhetorical, I suggest: https://en.wikipedia.org/wiki/Competition_law https://en.wikipedia.org/wiki/Competition_law https://en.wikipedia.org/wiki/United_States_antitrust_law https://en.wikipedia.org/wiki/United_States_antitrust_law https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3247362 https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3247362
  - throwbobaway313 8y ago
js2 8y ago
I enabled dmarc for my domain about a year ago enabling just reporting. So I get a dmarc report or two emailed to me daily. I have yet to actually check the reports. Can anyone recommend a free or cheap service or something I can run myself to summarize dmarc reports? edit: this Quora mentions some free services: https://www.quora.com/What-is-the-best-way-to-make-an-analysis-of-DMARC https://www.quora.com/What-is-the-best-way-to-make-an-analys... And I found this on Github: https://github.com/techsneeze/dmarcts-report-viewer https://github.com/techsneeze/dmarcts-report-viewer Any other recs?
deleted 8y ago
[deleted]
jeffreyrogers 8y ago
This stuff is easy to setup (in G suite you can do in in a hour or two if you know what needs to be done), but like most computer security best practices, the knowledge is out there but not well distributed, and not in the hands of the people who need to know it.
lostphilosopher 8y ago
I see this as a reflection of the candidates ability to find and listen to experts. I don't expect a candidate to understand how to do tech "right" - I'm in the industry and still get half of it wrong! However, when you're running a multi million dollar campaign you can afford to bring in experts to set this stuff up and audit your practices. In fact, I assume these candidates are already doing this and that if they are still not following some basic best practices it's because they are actively ignoring the experts they brought on to help them. That's what worries me. If they can't find or listen to these people now, what makes me think they'll be able to in office? (Related: "The internet is not a big truck...")
dontbenebby 8y ago
>I see this as a reflection of the candidates ability to find and listen to experts. The problem isn't finding experts. There's a lot of smart, well intentioned people in DC. (For example, everyone I met from 18F impressed me greatly, and nonprofit organizations like Mozilla have a presence in DC) The problem is that both congressional offices and political campaigns are extremely hierarchical. The culture in a political campaign or senate office is that junior staffers are supposed to be given orders and figure out how to implement them - not suggest different sets of orders.
- daveFNbuck 8y ago
  It's easy to find experts, but not everyone does. Some politicians prefer loyalty to expertise. At least one candidate was able to overcome the hierarchy of her campaign and get basic email security.
  - deleted 8y ago
    [deleted]
  - bluGill 8y ago
    Was that luck though, or active intent.

67 points by sahin-boydas 8y ago

deleted 8y ago

[deleted]

lawlessone 8y ago

To be fair i don't think the incumbent needs to be worried about that.

idlewords 8y ago

Say what you will about Hillary Clinton—at least that woman could run an email server.

lohszvu 8y ago
Do you really think she was the one running it?
october_sky 8y ago
> Say what you will about Hillary Clinton—at least that woman could run an email server. Except she didn't. She hired an IT person to run a personal email server.

AdmiralAsshat 8y ago

I'd put this in a different category than 2FA, password manager, or basic "watch out or phishing emails" training. All of those things can be enacted by the individual end-user if the organization doesn't enforce it. But it doesn't look like DMARC is something the individual can turn on or off--it's completely on their IT to set it up. I'm not sure how easy it is to setup, either. Assuming they're paying for Office 365 or G-Suite for outlook/gmail on campaign domains, is that something that Microsoft and/or Google will turn on automatically for you?

heavymark 8y ago
With domains registered at Google Domains it's very easy to enable. All domain registers do not support it. Mayor Pete uses GoDaddy and very easy to setup at that register as well.
jrockway 8y ago
To setup DMARC, you add a text record like _dmarc.example.com with content like "v=DMARC1; p=reject" (or perhaps a more permissive or canaried policy). I am not sure if Google sets it up automatically. I have no memory of setting it up for my gsuite domain... but the record is there. I probably added it at some point though. The advantage of DMARC against phishing is that people without access to your email server can't impersonate people in your organization. If you tried sending me an email with a "From: jon@jrock.us" header, it would be rejected by my server and I would never see it. This makes it much more difficult to spearphish someone. If you could send an email "this is your boss, look at the From: field, now click my link!", a lot of people would click that link. If the From: field is "spammer@phishing.invalid", you might think twice. Every little bit helps.
- erichurkman 8y ago
  If you have the domain through Google Domains and set up email through GSuite, they can set up DMARC automatically.
- sokoloff 8y ago
  Wouldn't someone still be able to send mail from jon@jrơck.us and even have it pass DMARC and DKIM checks if they bought that domain? (last o being a ơ [ơ]) I wrote that fake address, I know where the defect is, and I can't spot the difference on my screen right now. It just looks like the other 50 specks of dirt on my laptop screen.
  - egwynn 8y ago
    One common way to defend against a partial (or full) homograph attack is to have clients render IDNs as punycode. The downside is that it kinda pulls the plug on non-ascii domains. :-\

astazangasta 8y ago

I am sure i will get hundreds of downvotes for this but i still dont accept that the Russians targeted the DNC. Wikileaks says otherwise, the only people who examined the servers are a nakedly anti-Russian security outfit hired by the DNC and to date zero hard evidence has been presented this is true. There are so many holes in this narrative, and given the total lack of credibility the press has after the Russiagate collusion story we shouldnt also allow this piece to slip through as accepted fact.

codezero 8y ago
I’m not sure the consensus is that WikiLeaks targeted the DNC (it’s not a hacking organization afaik). I believe that Russia targeted literally everyone and released DNC data through WikiLeaks. Edit: I think OP edited their message.
belltaco 8y ago
There's some substantial evidence. https://nos.nl/nieuwsuur/artikel/2213767-dutch-intelligence-first-to-alert-u-s-about-russian-hack-of-democratic-party.html https://nos.nl/nieuwsuur/artikel/2213767-dutch-intelligence-... https://arstechnica.com/tech-policy/2018/03/dnc-lone-hacker-guccifer-2-0-pegged-as-russian-spy-after-opsec-fail/ https://arstechnica.com/tech-policy/2018/03/dnc-lone-hacker-...
- astazangasta 8y ago
  I've read both those accounts. The Dutch intelligence bit is unrelated to the DNC; they claim the same outfit they were surveilling is involved. They did not observe the Russians hacking the DNC. Read the story carefully to see the timing. As for Guccifer, the evidence indicates he operates out of CST (based on tweets and uploaded file timestamps), hardly where a Russian hacker would be situated. These are both pretty weak as evidence, not what i'd call substantial.
  - belltaco 8y ago
    And yet Wikileaks denial of them getting the emails from Russia without any proof whatsoever is somehow not weak? How would Wikileaks even verify that they were not dealing with a stooge of Russian intelligence?

andjd 8y ago

> just one presidential hopeful — Democratic candidate Elizabeth Warren — uses domain-based message authentication, reporting, and conformance policy — or DMARC. Another reason that Warren is my favorite of the democratic candidate right now. It's telling that the candidate with the most tech savvy is also the one proposing to break up the FAANGs for antitrust abuses.

simonh 8y ago
I'm not at all clear what a break up means. How do you break up a monolithic single platform like Facebook? Maybe spin off the messaging stuff but who cares about that? Google is tricky too, you could separate ad-driven search from everything else, but then the everything else bits would just die. How would that benefit users? Basically picking off bits of the edges of these services is just pointless, but splitting up the core service also seems crazy. It's like splitting up a car company by separating out the bit that makes the engines from the bit that makes the chassis. I can see it with Amazon splitting AWS from the store, but in that case both would just do fine thank you very much. Again, I'm not seeing any material benefits to anybody. I suppose it's possible profits from the store would be prevented from subsidising AWS, which might benefit competition. This is the only one that makes a lick of sense but it's not really a big problem to fix IMHO. So what are the actual proposals, or are they just vague pontificating at this stage?
- torstenvl 8y ago
  How is the amalgamation of Instagram, WhatsApp, Facebook.com, Facebook Messenger, Oculus, etc. a "monolithic single platform"? I don't quite understand how you've come to your "who cares about that?"/"How would that benefit users?" stance. If you're genuinely curious about how preventing monopolies can benefit consumers/users, and not just being rhetorical, I suggest: https://en.wikipedia.org/wiki/Competition_law https://en.wikipedia.org/wiki/Competition_law https://en.wikipedia.org/wiki/United_States_antitrust_law https://en.wikipedia.org/wiki/United_States_antitrust_law https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3247362 https://papers.ssrn.com/sol3/papers.cfm?abstract_id=3247362
- throwbobaway313 8y ago

js2 8y ago

I enabled dmarc for my domain about a year ago enabling just reporting. So I get a dmarc report or two emailed to me daily. I have yet to actually check the reports. Can anyone recommend a free or cheap service or something I can run myself to summarize dmarc reports? edit: this Quora mentions some free services: https://www.quora.com/What-is-the-best-way-to-make-an-analysis-of-DMARC https://www.quora.com/What-is-the-best-way-to-make-an-analys... And I found this on Github: https://github.com/techsneeze/dmarcts-report-viewer https://github.com/techsneeze/dmarcts-report-viewer Any other recs?

deleted 8y ago

[deleted]

jeffreyrogers 8y ago

This stuff is easy to setup (in G suite you can do in in a hour or two if you know what needs to be done), but like most computer security best practices, the knowledge is out there but not well distributed, and not in the hands of the people who need to know it.

lostphilosopher 8y ago

I see this as a reflection of the candidates ability to find and listen to experts. I don't expect a candidate to understand how to do tech "right" - I'm in the industry and still get half of it wrong! However, when you're running a multi million dollar campaign you can afford to bring in experts to set this stuff up and audit your practices. In fact, I assume these candidates are already doing this and that if they are still not following some basic best practices it's because they are actively ignoring the experts they brought on to help them. That's what worries me. If they can't find or listen to these people now, what makes me think they'll be able to in office? (Related: "The internet is not a big truck...")

dontbenebby 8y ago

>I see this as a reflection of the candidates ability to find and listen to experts. The problem isn't finding experts. There's a lot of smart, well intentioned people in DC. (For example, everyone I met from 18F impressed me greatly, and nonprofit organizations like Mozilla have a presence in DC) The problem is that both congressional offices and political campaigns are extremely hierarchical. The culture in a political campaign or senate office is that junior staffers are supposed to be given orders and figure out how to implement them - not suggest different sets of orders.

daveFNbuck 8y ago
It's easy to find experts, but not everyone does. Some politicians prefer loyalty to expertise. At least one candidate was able to overcome the hierarchy of her campaign and get basic email security.
- deleted 8y ago
  [deleted]
- bluGill 8y ago
  Was that luck though, or active intent.